January 2001 - openSUSE Security - openSUSE Mailing Lists

ssl ftp
by Kurt Seifried 05 Jan '01

05 Jan '01

SDSC/GT Secure FTP 1.0.3 http://www.glub.com/products/secureftp/ Secure FTP is a client package that allows for a secure connection to be made to an FTP daemon via SSL. I forget who it was that asked. Kurt Seifried, seifried(a)securityportal.com SecurityPortal - your focal point for security on the 'net

1 0

Re: [slug] Re: ftp/firewall security
by MaD dUCK 04 Jan '01

04 Jan '01

also sprach Tom Stepleton (on Thu, 04 Jan 2001 03:12:06PM -0500): > don't quite get your question, but isn't the problem you're talking about > what modules like ip_masq-ftp are for? I'm not sure this helps since these > modules are for the masquerading aspect of firewalling and not the > blocking aspect, but AFAIK these do pay attention to what's going on on > the protocol level and open ports accordingly. I know I had to load > ip_masq_ftp to get FTP working through my firewall, but I don't know > exactly what you're doing with NAT or much about NAT to beigin with. mh. these modules... now i remember. i read about them at one point in time, all excite about ip_masq_icq.o just so that i can let LAN users use ICQ on the MASQ'd net, but as it turns out, on my 2.2.17 kernel, these modules aren't even necessary: root@albatross ~> lsmod Module Size Used by b1pci 3992 1 (autoclean) b1 16320 0 (autoclean) [b1pci] capidrv 24840 3 (autoclean) kernelcapi 18516 2 (autoclean) [b1pci capidrv] capiutil 22400 0 (autoclean) [capidrv kernelcapi] slip 7856 2 (autoclean) autofs 9120 1 (autoclean) isdnloop 12628 6 (autoclean) isdn 112288 6 (autoclean) [capidrv isdnloop] yet, icq, ftp, irc and other work perfectly fine... i am not sure i know exactly what the purpose of these modules is. sure, ip_masq_quake is needed because quakeworld servers don't work with ports 6xxxx or whatever, and ip_masq_irc simply enables DCC transfers, but just take ip_masq_ftp and i am clueless. look at the following tcpdump output which is everything merlin ever has to say to my computer during an ftp session (until the password prompt), without ip_masq_ftp loaded: root@albatross ~> tcpdump -qi ippp0 src host 130.58.218.7 | grep -v auth 21:39:22.669348 < merlin.sccs.swarthmore.edu.ftp > pD4B8911C.dip.t-dialin.net.61822: tcp 0 (DF) 21:39:25.709893 < merlin.sccs.swarthmore.edu.ftp > pD4B8911C.dip.t-dialin.net.61822: tcp 69 (DF) 21:39:26.580174 < merlin.sccs.swarthmore.edu.ftp > pD4B8911C.dip.t-dialin.net.61822: tcp 0 (DF) 21:39:26.585833 < merlin.sccs.swarthmore.edu.ftp > pD4B8911C.dip.t-dialin.net.61822: tcp 36 (DF) sure, no data is transfered, but the point is - these are packets coming into interface ippp0, destined to be demasqueraded, on ports above 60000. if i had blocked 1024 and up, they would have never arrived, and the ftp session would have never been established. now, the same output with ip_masq_ftp loaded: 21:39:53.570288 < merlin.sccs.swarthmore.edu.ftp > pD4B8911C.dip.t-dialin.net.61832: tcp 0 (DF) 21:39:56.399793 < merlin.sccs.swarthmore.edu.ftp > pD4B8911C.dip.t-dialin.net.61832: tcp 69 (DF) 21:39:57.163834 < merlin.sccs.swarthmore.edu.ftp > pD4B8911C.dip.t-dialin.net.61832: tcp 0 (DF) 21:39:57.170270 < merlin.sccs.swarthmore.edu.ftp > pD4B8911C.dip.t-dialin.net.61832: tcp 36 (DF) unless i am totally not getting this, the output has two messages: ip_masq_ftp doesn't do anything to facilitate firewalling on the gateway machine, and (2), in only 31 seconds, my LAN made 10 connections to the outside world. no way i can just leave "some" ports open... anyway, i just checked and ip_masq_ftp is to enable active ftp transfers, nothing to do with passive... i don't think there's any way around a stateful firewall... and it's not just ftp: 22:08:25.052026 < merlin.sccs.swarthmore.edu.ssh > pD4B8911C.dip.t-dialin.net.61893: tcp 36 (DF) with an external interface ippp0, ipchains just needs a rule like ipchains -A input -p tcp -d 0/0 1024:65536 -j ACCEPT to work... thanks for your time anyway! martin [greetings from the heart of the sun]# echo madduck@!#:1:s@\@@@.net -- an avocado-tone refrigerator would look good on your resume.

1 0

suggestion for ssh packaging
by Bob Vickers 04 Jan '01

04 Jan '01

Hello, I have 2 suggestions that I believe will increase both security and usability: (1) split the ssh packages into client and server parts (2) have an ssh client installed as default It is absurd that someone who installs an ssh client should find themselves running an ssh server. I would like to see most desktops in the world running an ssh client, but only a tiny minority should be running ssh servers. The current situation could lead to people who have installed ssh so that they can access remote servers securely finding their home computers have been compromised because they unknowingly run an ssh service. The second suggestion is just to make my life easier...part of my job is to explain to people how to install ssh clients on their home machine, and the less they have to do the better. Happy new year, Bob ============================================================== Bob Vickers R.Vickers(a)dcs.rhul.ac.uk Dept of Computer Science, Royal Holloway, University of London WWW: http://www.cs.rhul.ac.uk/home/bobv Phone: +44 1784 443691

2 1

memory leak of secumod with SuSE 7.0
by Dorothea Mücke-Herzberg 04 Jan '01

04 Jan '01

Hello, There seems to be a memory leak of secumod with SuSE7.0, at least on my system (Compaq DL380 with Smart Array). The system freezes every few days or so when secumod is enabled. The syslog shows no entries between the time the systems freezes and a reboot. Sometimes I find those type of entries as the last ones: Dec 3 08:00:01 ssc kernel: VM: killing process sh Dec 3 08:04:09 ssc kernel: VM: killing process idled Dec 3 08:15:03 ssc kernel: VM: killing process run-crons This hints towards memory problems (I have 128MB RAM and 128MB swap). No services are running yet (www,mail,dns), just X11. After a reboot one sees a steady increase in memory usage although the system isn't in use at all. Before Christmas I finally disables secumod and since then it is running fine. Has anyone else experienced this problem and know of a solution? (I really would like to run secumod for better security) Cheers, Dorothea

1 0

AW: [suse-security] Intrusion detection?
by Battisti Markus 04 Jan '01

04 Jan '01

i find some tools that works good on my servers at www.psionic.com the portsentry and the logcheck its not a inrusion detection but ist is a portscan detection it guards unused ports ,,, /'^'\ ( o o ) oOOO--(_)--OOOo---------------------- Mit Freundlichen Grüssen/Best Regards proTask Consulting Battisti Markus PGP key available on request This message was sent using 100% recyclable electrons Hi, what are the recommended tools to add to a (dial-up) NAT gateway to detect attacks on that gateway? I am not (yet :->) looking for tools how to detect things after the deed is done, but for some kind of an early warning system (and I am not particularly interested in reading the raw logs emitted by ipchains). http://www.securityfocus.com/ lists a couple of things, but this seems to be just an *unreviewed* long list of tools, with rather unknown quality. TIA Stefan --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

proftpd-1.2.rc2: BUG! passive FTP not working (FIX attachted)
by Steffen Dettmer 04 Jan '01

04 Jan '01

Hi, the package mention above contains a bug concered to passive mode FTP. After upgrading, no passive FTP is possible! I attach a modified SPEC file and the needed patch. HOW TO BUILD: ------------- 1. install the right source rpm (via rpm -i proftpd.spm) 2. overwrite the SPEC file in /usr/src/packages/SPECS/ 3. copy the patch to /usr/src/packages/SOURCES 4. build RPMS (rpm -ba /usr/src/packages/SPECS/proftpd.spec) 5. upgrade to new RPM (rpm -U /usr/src/packages/RPMS/i386proftpd-1.2.0rc2-37.i386.rpm) [sorry for long line] PLEASE NOTE: If you haven't openLDAP installed, you may remove openLDAP support by editing the SPEC file: Change line 68 from: --with-modules=mod_ratio:mod_readme:mod_linuxprivs:mod_ldap \ to: --with-modules=mod_ratio:mod_readme:mod_linuxprivs \ (before STEP 4, or if you get ldap errors with executing step 4; in the latter case edit file and redo step 4 and go on; that seems to be neccesary for SuSE 6.1) Standard disclaimer applies. UNTESTED except a quick test on a SuSE 6.1 but the new patch is a very simple one - but who knows! I wonder why nobody got this problem here before (it's known on proftpd.net...) TECHNICAL NOTE: The spec file got a new release number (37), hope this makes no conflicts. I only added the patch. I have no time to supply a diff of the SPECs right now, but that's what SuSE support is for ;) short in time as always ;) oki, Steffen -- Dieses Schreiben wurde maschinell erstellt, es trägt daher weder Unterschrift noch Siegel.

3 2

postfix
by Faessen Jean-Paul 03 Jan '01

03 Jan '01

Hi to all I wish you all a very good 2001! As descriped in the SuSe-handbook of 7.0 I installed postfix instead of sentmail. Then I also changed my file permissions to secure as described. After this Netscape didn't want to remember the inputs in preferences When logging out or logging in,I was asked for my password.Impossible to put in. Iwas forced to reinstall my system,but now I would like to know what went wrong. Now I'm back on sentmail,no tripwire,no securitysettings in yast... I did never have problems,and to be honest I have nothing to protect but I want to change to cable-connection and there security is a problem. Thanks for helping... Jean-Paul Faessen

2 1

can`t login as root
by icepic 03 Jan '01

03 Jan '01

first a happy new year !! my English is not very good, so i hope that everybody understandt me. My question: I want to login as root on my ftp-serive, but i cannot. The login is incorrect. What is to do to solve the problem

7 7

Re: [suse-security] SuSE Security FAQ
by Nix 03 Jan '01

03 Jan '01

Yes, this was my intended plan, however, I am more than happy to accept sections written by YOU! *hint hint* (anyone who wants credit for writing a major section will receive a listing in a CREDITS file. At least thats what I've been thinking of doing... Thoughts anyone?) -Nix At 10:38 PM 16/12/2000 +0800, you wrote: >I would like to see additional security programs i.e., >snort, Portsentry, SuSEfirewall, etc. Thus people will know >the things to install to beef up security, maybe even >Howto's on setting these up(?). >- -- Microsoft is to operating systems & security .... .... what McDonalds is to gourmet cooking

4 3

can`t login as root
by icepic 03 Jan '01

03 Jan '01

jo thx to all @dennis: i think , you cannot use su on ftp-service!!

1 0

RE: [suse-security] can`t login as root
by Raffy 03 Jan '01

03 Jan '01

>I want to login as root on my ftp-serive, but i cannot. >The login is incorrect. >What is to do to solve the problem 1. To login as root via FTP is a very bad idea: The password is transmitted in plain text. & ... 2. You have a file /etc/ftpusers there are users listed which cannot login via ftp (root may be in there) 3. depending on the FTP server you use, there is a config file which might deny ftp logins. Hope that helps Raffy

1 0

Re: [suse-security] can`t login as root
by Erwin Zierler - Stubainet 03 Jan '01

03 Jan '01

Hi... At 13:45 03.01.01 +0100, you wrote: >first a happy new year !! > >my English is not very good, so i hope that everybody understandt me. > >My question: > >I want to login as root on my ftp-serive, but i cannot. You should NEVER use the root account for FTP, never, period. >The login is incorrect. >What is to do to solve the problem Create a user account and use this account for FTP. Erwin PS.: please dont use the HTML format to send messages to this list, I am using a 'normal' email client that doesn't understand HTML and I bet there are many others... Erwin Zierler | Web-/Hostmaster - Stubainet | Email: Erwin.Zierler(a)stubainet.at / webmaster(a)stubainet.at | Tel.: 05225 - 64325 Fax 99 Mobil: 0664 - 130 67 91

1 0

Re: [suse-security] ssh (sftp?) problems
by Jason P. Stanford 03 Jan '01

03 Jan '01

Hmmm. Checked that. I'd had it commented out. Also checked /etc/profile and the files in /etc/profile.d just to be sure. No 'fortune' running anywhere. I just noticed that there is no sftp binary! Tried to build from the src.rpm from ftp.suse.de which fails consistently due to some missing imake file in /var/tmp??? Have you encountered any of this? --- Stefan Suurmeijer <stefan(a)symbolica.nl> wrote: > On Tue, 2 Jan 2001, Jason P. Stanford wrote: > > > I am having problems scp (sftp?) to my server. This is occuring > with > > the following clients > > > > These are the versions (via '% scp -V'): > > scp: SSH Secure Shell 2.3.0 (non-commercial version) on > > mips-sgi-irix6.5 > > scp: SSH Secure Shell 2.3.0 (non-commercial version) on > rs6000-ibm-aix > > -and- > > a Windows version under site license to my university SSH(c) Secure > > Shell(TM) Version 2.3 (Build 135), if this means anything to > anyone. > > > > % tail /var/log/messages > > Jan 3 01:21:09 foo kernel: Packet log: input ACCEPT eth0 PROTO=6 > > 128.180.1.1:1201 128.180.1.2:22 L=48 S=0x00 I=62150 F=0x4000 T=128 > SYN > > (#10) > > Jan 3 01:21:11 foo sshd[6541]: Accepted password for randuser from > > 128.180.1.1 port 1201 ssh2 > > Jan 3 01:21:11 foo sshd[6541]: subsystem request for sftp > > Jan 3 01:21:11 foo sshd[6541]: error: channel 0: internal error: > we do > > not read, but chan_read_failed for istate 8 > > > > I had a similar problem with sftp/scp. Turned out the account I was > sftp-ing to had /usr/bin/fortune in its .profile, which nuked the > connection. > > cheers > > Stefan > > > > > . > QUIT > he > connection. > > cheers > > Stefan > > > > > . > QUIT > __________________________________________________ Do You Yahoo!? Yahoo! Photos - Share your holiday photos online! http://photos.yahoo.com/

2 1

ssh (sftp?) problems
by Jason P. Stanford 03 Jan '01

03 Jan '01

I am having problems scp (sftp?) to my server. This is occuring with the following clients These are the versions (via '% scp -V'): scp: SSH Secure Shell 2.3.0 (non-commercial version) on mips-sgi-irix6.5 scp: SSH Secure Shell 2.3.0 (non-commercial version) on rs6000-ibm-aix -and- a Windows version under site license to my university SSH(c) Secure Shell(TM) Version 2.3 (Build 135), if this means anything to anyone. % tail /var/log/messages Jan 3 01:21:09 foo kernel: Packet log: input ACCEPT eth0 PROTO=6 128.180.1.1:1201 128.180.1.2:22 L=48 S=0x00 I=62150 F=0x4000 T=128 SYN (#10) Jan 3 01:21:11 foo sshd[6541]: Accepted password for randuser from 128.180.1.1 port 1201 ssh2 Jan 3 01:21:11 foo sshd[6541]: subsystem request for sftp Jan 3 01:21:11 foo sshd[6541]: error: channel 0: internal error: we do not read, but chan_read_failed for istate 8 I have uncommented the 'Subsystem sftp' line. What gives? Everything worked fine for the old ssh1 setup... __________________________________________________ Do You Yahoo!? Yahoo! Photos - Share your holiday photos online! http://photos.yahoo.com/

1 0

misc: ftp.gwdg.de, new year
by Roman Drahtmueller 02 Jan '01

02 Jan '01

Hello, paranoids, First off, on behalf of SuSE, I would like to wish a beautiful, happy and successful new year. Many things happened, but more are to come this year. I am convinced that there will be many positive changes in this year to come, especially for the security field. Secondly, something organisational: ftp.gwdg.de (the main mirror for the SuSE ftp servers) will be down for a night, while the filesystem will be rebuilt. The files will drippling in while the ftp server will still be accessible. So don't worry if you do not find any updates for some hours... Thanks, Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - -

2 1

telnet as a root on a suse 6.3 suse server
by Francesco Masiello 02 Jan '01

02 Jan '01

I must be able to telnet from a terminal (not a console) as a root without using su. In solaris i could do that editing /etc/default/login file,but i can't find it on this Operating System. How can i do ? Thanks

8 7

Re: [suse-security] Login restriction
by Raffy 02 Jan '01

02 Jan '01

>> I have a user on my system who needs an ssh login shell. I don't want that >> user to escape his home directory. Is there an easy solution to restrict him >> to only his home. I could use chroot to do so, but that would involve quite >> some work, wouldn't it. >do a 'man bash' and search for restricted (shell), may be is this what you want Oh sorry, I already did that. I forgot to mention. The restricted shell would be perfect, but I want my users to be able to CD around in their home... Any ideas? Thanx Raffy

1 0

Re: [suse-security] How can I solve this problem with mail server
by Luis Oliveira 02 Jan '01

02 Jan '01

Thanks for the info, but is it possible to reject mail if the user doesn't exist in the mail server ? The sender always uses yahoo and hotmail. I cannot reject mail from those domains because people here receive messages from there (newspaper business you know). Anyway I'm going to check postfix. TIA // luis oliveira > Implement filterings using orbs or maps. www,mail-abuse.com. Also you may > want to switch to postfix. Seee www.postfix.org/ press links (they link to 2 > of my articles which have some content on why postfix is so damn good =). > > Kurt Seifried, seifried(a)securityportal.com > SecurityPortal - your focal point for security on the 'net > > ----- Original Message ----- > From: "Luis Oliveira" <lpoliveira(a)mail.telepac.pt> > To: <suse-security(a)suse.com> > Sent: Sunday, December 31, 2000 12:45 PM > Subject: [suse-security] How can I solve this problem with mail server > > >> Hi to all, >> >> >> My company mail server is running on a Suse 6.3 system, with sendmail > 8.9.3, >> and until sotime ago everything was running beautifully. >> >> What happened is that we started to receive mail messages with links to >> porno sites. These mail messages are always addressed to non existant > users >> in the mail system. We have tried to configure sendmail by way of webadmin >> to reject mail from the source addresses but the source adress is always >> changing. Is there any security problem with Suse 6.3 and/or sendmail that >> can cause this ? >> >> >> What can I do to solve this? >> >> >> >> Thanks in advance

3 2

Fwd: Linux port of OpenBSD ftpd patched
by Nix 02 Jan '01

02 Jan '01

Isn't this the default ftp server in SuSE? Does SuSE have it's own patches for this? If not it may be worth looking at this guys work. Happy New Year Everyone and good luck catching up with all the extra work created by the xmas/new year break! -Nix >Approved-By: beng(a)SECURITYFOCUS.COM >Delivered-To: bugtraq(a)lists.securityfocus.com >Delivered-To: bugtraq(a)securityfocus.com >Date: Thu, 28 Dec 2000 13:13:30 -0800 >Reply-To: bugtraq(a)THEOPHILUS.REACHIN.COM >Sender: Bugtraq List <BUGTRAQ(a)SECURITYFOCUS.COM> >From: "Trenholme, Sam" <bugtraq(a)THEOPHILUS.REACHIN.COM> >Subject: Linux port of OpenBSD ftpd patched >X-cc: david.madore(a)ens.fr, rrw(a)reptile.eu.org >To: BUGTRAQ(a)SECURITYFOCUS.COM > >I have patched David Madore's Linux port of OpenBSD's ftpd against the >problems present in replydirname(). While the word is that Linux is not >currently exploitable, it is better to be safe than sorry. > >I have also patched against the setproctitle() problems previously >reported here, even though they are a non-issue due to the manner David >Madore ported OpenBSD's FTPD to Linux. > >The patches are against the 0.2.3 release of ftpd-BSD (David Madore's name >for the port), and are available in RPM format here: > > http://www.samiam.org/rpms/ > >David Madore: Thank you for your hard work porting OpenBSD ftpd to Linux. >I hope an official patched release will come to light soon. > >- Sam --- Nix - SuSE-Security FAQ Maintainer http://www.cotse.com/nix/suse-security-faq/

2 1

Nice little newbie review
by Nix 02 Jan '01

02 Jan '01

This is an interesting review that the SuSE marketing droids may be able to use.. http://www.linuxtests.org/articles/distributions/suse/7.0/ It pretty much mirrors what I think of SuSE 7.0.. I had a very similar problem installing on my Sparc.. where linuxrc would just die... Does anyone else HATE YaST2???? -Nix -- Microsoft is to operating systems & security .... .... what McDonalds is to gourmet cooking

5 5

i know that this is a security list.
by NightWatcher 01 Jan '01

01 Jan '01

But i wanna say HAPPY NEWYEAR to all. And may we protect and research our linux distributions. Ich wollte jetzt sagen gelucklich neuejahre aller leute. moge wir unser linux distributions beschermen und researchen Remko Lodder Cserviceadmin @ irc.quicknet.nl TechAdmin @ irc.super-chat.nl -=The Linux Just Will OverRule=- -=Shoot the Bill=-

1 0

[suse-security] How can I solve this problem with mail server
by Luis Oliveira 01 Jan '01

01 Jan '01

Hi to all, My company mail server is running on a Suse 6.3 system, with sendmail 8.9.3, and until sotime ago everything was running beautifully. What happened is that we started to receive mail messages with links to porno sites. These mail messages are always addressed to non existant users in the mail system. We have tried to configure sendmail by way of webadmin to reject mail from the source addresses but the source adress is always changing. Is there any security problem with Suse 6.3 and/or sendmail that can cause this ? What can I do to solve this? Thanks in advance // luis oliveira

2 1